A flaw in the send_file function of aaPanel’s Download Endpoint permits manipulation of the filename argument to perform path traversal. The attack can be carried out remotely and may allow an attacker to read or execute arbitrary files, potentially escalating to remote code execution if the attacker possesses sufficient credentials. The flaw exists in all releases up to and including aaPanel 8.25.0.

aaPanel, all versions up to and including 8.25.0, are affected. The vulnerability resides in the BTPanel/routes/v2.py component of the Download Endpoint. Any system running aaPanel within this version range that accepts external requests to the download endpoint is at risk.

The CVSS score of 5.3 indicates moderate severity, and no EPSS score is available. The vulnerability is not yet listed in the CISA KEV catalog. Attackers can exploit the flaw remotely; however, the vendor notes that both the LFI and RCE vectors require authentication. Because the flaw is publicly disclosed and exploit code is available, the likelihood of exploitation is non‑negligible for attackers with valid credentials or those able to bypass authentication mechanisms.